074a80265ee7aa7ec928a7649e1d8b7c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

074a80265ee7aa7ec928a7649e1d8b7c_JaffaCakes118
Size

1.4MB
MD5

074a80265ee7aa7ec928a7649e1d8b7c
SHA1

858891bdb41507c2f2f036c7f2d0dd049bf03393
SHA256

383f10beb4673cecb479da3e434bc06cd77b7eb78fc70ded6b2f0bfcbd138ec6
SHA512

89e2e08d7fbbcc78a6080b00561a508f0b2d3947df93c66352ca4d71c3c5c277c010615c54e2bdfb2f04a8105b193308134f19700f86844ce9d934f36c48c7f2
SSDEEP

24576:zke2ylgGE/LZz3oDB/F9yyny/83bpv7rSNjnkYxnbkkrz7LdS+FvhVNk:Ie2ylgGCGDBLnrNnMLz7RS+v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
074a80265ee7aa7ec928a7649e1d8b7c_JaffaCakes118

Files

074a80265ee7aa7ec928a7649e1d8b7c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

756441461aae9c8030bd90ee19471a34

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\_PROJECTS\WinLine\WinAntiSpyware\_Release\WAS6.pdb

Imports

shfolder

SHGetFolderPathA
SHGetFolderPathW

shell32

SHGetMalloc
ord25
ord21
ord18
Shell_NotifyIconA
ShellExecuteA
ord155
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHEmptyRecycleBinA
SHQueryRecycleBinA
SHFileOperationA
SHAppBarMessage

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetOpenUrlA
InternetSetCookieA
InternetOpenA
InternetCanonicalizeUrlA
InternetCloseHandle
InternetGetConnectedState

mfc71

ord1641
ord1571
ord3441
ord3641
ord501
ord709
ord5642
ord5203
ord6020
ord5491
ord1248
ord3287
ord5641
ord4123
ord4001
ord4749
ord3883
ord2884
ord2867
ord3587
ord3680
ord2876
ord754
ord2987
ord3328
ord1654
ord1598
ord2878
ord298
ord384
ord629
ord5089
ord317
ord584
ord1434
ord1439
ord1024
ord1091
ord4044
ord6205
ord1025
ord5059
ord6282
ord908
ord1263
ord5154
ord4104
ord3760
ord777
ord577
ord293
ord2467
ord3850
ord1916
ord5420
ord2475
ord6006
ord4083
ord865
ord2020
ord5323
ord3795
ord2931
ord1161
ord3337
ord2991
ord1247
ord3423
ord2086
ord3164
ord587
ord3684
ord4394
ord2719
ord1545
ord556
ord744
ord5346
ord1452
ord4108
ord3596
ord2371
ord6017
ord3799
ord3683
ord4541
ord334
ord593
ord5124
ord566
ord757
ord3830
ord1054
ord5119
ord1126
ord2248
ord442
ord675
ord548
ord559
ord747
ord3174
ord3333
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord1395
ord3881
ord4243
ord1650
ord2098
ord2657
ord305
ord6173
ord776
ord5402
ord2466
ord5710
ord1440
ord6179
ord5529
ord2292
ord4648
ord4692
ord605
ord356
ord354
ord4580
ord3835
ord2948
ord3182
ord280
ord283
ord783
ord774
ord2130
ord4238
ord4078
ord6037
ord2346
ord5640
ord2234
ord1580
ord1929
ord2233
ord5727
ord6283
ord4350
ord1031
ord1647
ord1589
ord739
ord6041
ord6310
ord5097
ord6040
ord2306
ord4085
ord3635
ord3595
ord5227
ord4569
ord5567
ord570
ord759
ord2249
ord1716
ord1377
ord6172
ord6178
ord2263
ord3473
ord5658
ord2090
ord1637
ord1558
ord4236
ord3214
ord642
ord3551
ord1643
ord715
ord1581
ord3139
ord3292
ord3676
ord3583
ord1594
ord2983
ord3324
ord748
ord2095
ord1591
ord4240
ord3317
ord741
ord1397
ord6266
ord1933
ord1484
ord4099
ord2091
ord1570
ord4237
ord3229
ord657
ord1931
ord1483
ord4098
ord2089
ord1547
ord4234
ord3171
ord591
ord1554
ord3195
ord620
ord1587
ord3307
ord731
ord1550
ord3178
ord599
ord1576
ord1575
ord3249
ord671
ord1652
ord1596
ord2985
ord3326
ord752
ord2097
ord1649
ord1593
ord4242
ord3319
ord743
ord1638
ord1559
ord3215
ord643
ord3315
ord1646
ord1588
ord3312
ord736
ord1635
ord1543
ord3157
ord583
ord1645
ord1586
ord3304
ord730
ord1644
ord1584
ord3298
ord1636
ord1548
ord3172
ord592
ord1639
ord1568
ord3227
ord656
ord1640
ord1569
ord3228
ord2328
ord1265
ord2327
ord4032
ord282
ord2932
ord1264
ord4036
ord4037
ord1262
ord4033
ord4034
ord2319
ord1260
ord259
ord1971
ord2938
ord1092
ord3233
ord423
ord660
ord4063
ord866
ord5466
ord3574
ord3454
ord3437
ord3430
ord3488
ord502
ord5647
ord1966
ord3474
ord2802
ord3563
ord5991
ord4761
ord5994
ord3406
ord3571
ord3230
ord3255
ord5915
ord1402
ord4232
ord5073
ord4261
ord5331
ord6297
ord5320
ord6286
ord5731
ord4115
ord2958
ord2092
ord658
ord572
ord760
ord6275
ord2654
ord1979
ord6120
ord567
ord758
ord2075
ord2074
ord2264
ord3348
ord3651
ord5833
ord2372
ord5613
ord1930
ord416
ord2160
ord2794
ord4118
ord1564
ord6223
ord651
ord3244
ord2094
ord4100
ord1955
ord3204
ord2370
ord5634
ord3163
ord326
ord2882
ord3401
ord5214
ord1425
ord2873
ord4081
ord5563
ord3997
ord272
ord769
ord1917
ord1249
ord1486
ord2322
ord5868
ord5403
ord2468
ord2451
ord907
ord2271
ord2272
ord4109
ord2321
ord1482
ord3088
ord2021
ord630
ord385
ord3397
ord6236
ord2899
ord2469
ord911
ord2933
ord1489
ord299
ord1185
ord5871
ord3989
ord3761
ord1283
ord2495
ord5746
ord5866
ord5716
ord2131
ord1258
ord745
ord2751
ord2748
ord3931
ord2288
ord2280
ord631
ord386
ord557
ord5873
ord3879
ord2866
ord3875
ord6067
ord4353
ord3934
ord781
ord784
ord762
ord1187
ord1191
ord4035
ord304
ord300
ord297
ord5182
ord4212
ord4735
ord4890
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord1908
ord4185
ord3403
ord4722
ord4282
ord1600
ord5960
ord5235
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277

msvcr71

_onexit
__dllonexit
??1type_info@@UAE@XZ
_vsnprintf
strrchr
memset
_snprintf
floor
_i64toa
_atoi64
_mbspbrk
_local_unwind2
_mbscspn
_mbsspn
_ismbcspace
vswprintf
_vscwprintf
strtoul
sprintf
wcslen
_except_handler3
_CxxThrowException
__CxxFrameHandler
atol
isdigit
strtol
_strlwr
_strnicmp
strncmp
qsort
_mbsnbcpy
_mbsrchr
_strdup
wcscpy
?terminate@@YAXXZ
_c_exit
ceil
strstr
strftime
_resetstkoflw
_mbctype
fclose
fscanf
fopen
realloc
_beginthreadex
atoi
_stricmp
_purecall
_mbscmp
_mbsstr
_mbschr
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
vsprintf
_vscprintf
_mbsicmp
_mbsinc
memmove
_localtime64
_time64
__RTDynamicCast
free
malloc
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
_cexit
_controlfp
_wcsdup
_setmbcp
_mbslwr

kernel32

GetCurrentThread
GetCurrentProcess
GetVersion
DeleteCriticalSection
lstrcmpiA
RaiseException
GetEnvironmentVariableA
InitializeCriticalSection
GetModuleHandleA
GetFullPathNameA
lstrcpynA
WritePrivateProfileStringA
WriteProfileStringA
GetPrivateProfileStringA
GetProfileStringA
WriteFile
OpenProcess
MultiByteToWideChar
ResumeThread
GetExitCodeProcess
Sleep
EnterCriticalSection
GetFileAttributesA
WaitForSingleObject
CloseHandle
DeleteFileA
CreateDirectoryA
GetProcAddress
FreeLibrary
LoadLibraryA
LocalFree
FormatMessageA
lstrlenA
LocalAlloc
GetModuleFileNameA
InterlockedIncrement
GetLogicalDriveStringsA
GetLocalTime
GetTickCount
GetShortPathNameA
GetLongPathNameA
FindResourceExA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
FindResourceA
GetFileAttributesExA
lstrlenW
InterlockedDecrement
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetLastError
SetUnhandledExceptionFilter
GetStartupInfoA
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
DebugBreak
GetCurrentProcessId
GetFileSize
ReadFile
FlushFileBuffers
CreateEventA
SetEvent
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
SetEndOfFile
SetFilePointer
LeaveCriticalSection
lstrcpyA
MulDiv
GetWindowsDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenMutexA
TerminateProcess
CreateMutexA
InterlockedExchangeAdd
OpenEventA
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
lstrcmpA
ExpandEnvironmentStringsA
GetPrivateProfileSectionNamesA
RemoveDirectoryA
SetFileAttributesA
GetDriveTypeA
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeFormatA
GetDateFormatA
GetCurrentThreadId
WriteProcessMemory
VirtualProtect
FindResourceW
FindResourceExW
GetTempPathA
GetExitCodeThread
CreateProcessA
lstrcatA
FindClose
FindFirstFileA
CreateThread
GetSystemDirectoryA
FindNextFileA
ReleaseMutex
ResetEvent
TerminateThread
SetThreadPriority
WritePrivateProfileSectionA
GetPrivateProfileSectionA
MoveFileExA
Module32Next
Module32First
MapViewOfFileEx
CreateFileMappingA
UnmapViewOfFile
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationA
lstrcatW
lstrcpyW
lstrcmpW
CreateFileW
GetFileAttributesW
ReleaseSemaphore
CreateSemaphoreA
DeviceIoControl
HeapDestroy
HeapReAlloc
HeapSize
GetSystemTime
CreateFileA
SetErrorMode

user32

IsRectEmpty
GetSubMenu
TrackPopupMenu
SetFocus
MapWindowPoints
LoadMenuA
ReleaseCapture
SetCapture
RegisterWindowMessageA
DrawStateA
CreateWindowExA
RegisterClassA
EndPaint
BeginPaint
SetCursor
LoadCursorA
GetCursor
MessageBoxA
SetParent
SetMenuDefaultItem
DrawIcon
SetActiveWindow
GetSystemMenu
LockWindowUpdate
GetWindowTextA
SendMessageTimeoutA
GetClassLongA
EnumWindows
GetWindowTextLengthA
SetWindowTextA
OpenClipboard
EmptyClipboard
CloseClipboard
GetDlgCtrlID
CountClipboardFormats
DestroyIcon
InsertMenuItemA
IsMenu
GetMenuState
GetMenuItemCount
GetMenuDefaultItem
GetMenuItemInfoA
SetMenuItemBitmaps
SetMenuItemInfoA
FrameRect
TrackPopupMenuEx
UnionRect
GetMenuItemRect
SystemParametersInfoA
keybd_event
CallNextHookEx
SetWindowsHookExA
PostThreadMessageA
LoadStringW
LoadBitmapW
LoadIconW
LoadCursorW
LoadImageA
LoadImageW
UnhookWindowsHookEx
WindowFromPoint
CreateIconFromResourceEx
ShowWindow
IsZoomed
IsIconic
GetWindowPlacement
GetWindowThreadProcessId
LoadIconA
UnregisterClassA
AnimateWindow
GetClassNameA
BringWindowToTop
OffsetRect
SetRectEmpty
MsgWaitForMultipleObjects
PeekMessageA
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
GetDesktopWindow
IsWindowVisible
GetKeyState
ValidateRect
FindWindowExA
GetSysColor
IsWindowEnabled
FillRect
InflateRect
UpdateWindow
InvalidateRect
SetRect
EnableScrollBar
SetScrollPos
GetSystemMetrics
PtInRect
GetFocus
CopyRect
DrawFocusRect
DrawTextA
GetParent
ClientToScreen
SetWindowPos
GetClientRect
SetWindowLongA
GetWindowLongA
GetWindow
LoadStringA
wsprintfA
GetDlgItem
IsWindow
CloseWindow
SetForegroundWindow
EnableMenuItem
CreatePopupMenu
EnableWindow
SetTimer
KillTimer
GetWindowRgn
ScreenToClient
GetCursorPos
TrackMouseEvent
SendMessageA
GetDC
SetWindowRgn
ReleaseDC
GetWindowDC
CopyImage
GetWindowRect
FindWindowA
PostMessageA
RedrawWindow
LoadBitmapA
AppendMenuA
GetMenuItemID
DestroyMenu
CallWindowProcA
GetAsyncKeyState
GetComboBoxInfo
GetCapture
DestroyCursor
LookupIconIdFromDirectoryEx

gdi32

GetTextMetricsA
ExtCreatePen
SetStretchBltMode
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
Rectangle
CreateBrushIndirect
GetBkColor
GetBkMode
TextOutA
CreateDIBitmap
CreateEllipticRgn
GetPixel
SetPixel
GetDeviceCaps
GetTextColor
SetBkColor
GetBitmapBits
SetBitmapBits
GetObjectA
GetDIBits
DeleteObject
CreateRectRgn
CombineRgn
PtInRegion
SelectObject
DeleteDC
SetBkMode
SetTextColor
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPoint32A
CreateSolidBrush
CreatePen
MoveToEx
LineTo
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetStockObject
CreateFontA
PatBlt
StretchBlt

msimg32

AlphaBlend

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteKeyA
CryptDestroyHash
QueryServiceStatus
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CloseServiceHandle
CreateServiceA
GetUserNameA
RegNotifyChangeKeyValue
RegOpenKeyExW
RegSetValueExA
RegSetValueExW
CryptCreateHash
CryptGetHashParam
CryptHashData
CryptAcquireContextA
CryptReleaseContext
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

comctl32

ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_Draw
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Remove
_TrackMouseEvent
ImageList_GetIconSize
ImageList_GetIcon
ord17
ImageList_SetBkColor
ImageList_DrawEx

shlwapi

PathMatchSpecA
PathAppendA
PathAddBackslashA
PathUnquoteSpacesA
PathIsDirectoryEmptyA
SHDeleteValueA
SHDeleteKeyA
PathFindExtensionA
PathRenameExtensionA
PathFindFileNameA
PathStripPathA
PathRemoveFileSpecA
PathCombineA
SHCreateStreamOnFileA
PathIsDirectoryA
PathFileExistsA
PathCanonicalizeA

ole32

CoCreateGuid
StringFromGUID2
StgOpenStorage
StringFromCLSID
CoTaskMemFree
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
StgCreateDocfile

oleaut32

VariantInit
GetErrorInfo
VariantCopy
VariantClear
VarBstrFromDate
SysAllocString
SysFreeString
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
VarDateFromStr
SystemTimeToVariantTime
SysStringLen

msvcp71

?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

iphlpapi

GetUdpTable
SetTcpEntry
GetTcpTable

ws2_32

WSAStartup
WSACleanup
gethostname
gethostbyaddr
inet_ntoa
getservbyport
ntohs
connect
closesocket
sendto
socket

imagehlp

ImageLoad
ImageUnload
ImageDirectoryEntryToData

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 220KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 541B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

756441461aae9c8030bd90ee19471a34

Headers

File Characteristics

PDB Paths

Imports

shfolder

shell32

version

wininet

mfc71

msvcr71

kernel32

user32

gdi32

msimg32

advapi32

comctl32

shlwapi

ole32

oleaut32

msvcp71

iphlpapi

ws2_32

imagehlp

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 220KB - Virtual size: 217KB

.data Size: 20KB - Virtual size: 24KB

.tls Size: 4KB - Virtual size: 541B

.rsrc Size: 28KB - Virtual size: 27KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 220KB - Virtual size: 217KB

.data
Size: 20KB - Virtual size: 24KB

.tls
Size: 4KB - Virtual size: 541B

.rsrc
Size: 28KB - Virtual size: 27KB